Hiperdino’s REST API v1.0 exposes a public endpoint called /customer/check that permits an authenticated user to supply a telephone number or an email address. If the supplied value belongs to a registered customer, the service returns that customer’s email and telephone number. The only authentication required is a static bearer token, and there is no rate limiting or generic error handling. Thus the flaw is an access‑control weakness that allows an adversary who possesses a valid bearer token to enumerate contact details of existing users, constituting an information‑disclosure vulnerability.

Hiperdino REST API, version 1.0.

The CVSS score of 9.2 classifies this flaw as critical. Because the API is publicly reachable over the network and requires only a static bearer token, the attack vector is remote. Although the attacker must first obtain a valid bearer token to exploit the vulnerability, once that prerequisite is met, enumeration is trivial and no further privileges are needed. The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, yet the high CVSS and the lack of mitigation make the risk significant.